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Abstract 

This paper studies the effect of modifying the control limits of an aircraft engine to obtain additional 
performance. In an emergency situation, the ability to operate an engine above its normal operating limits 
and thereby gain additional performance may aid in the recovery of a distressed aircraft. However, the 
modification of an engine’s limits is complex due to the risk of an engine failure. This paper focuses on 
the tradeoff between enhanced performance and risk of either incurring a mechanical engine failure or 
compromising engine operability. The ultimate goal is to increase the engine performance, without a large 
increase in risk of an engine failure, in order to increase the probability of recovering the distressed 
aircraft. The control limit modifications proposed are to extend the rotor speeds, temperatures, and 
pressures to allow more thrust to be produced by the engine, or to increase the rotor accelerations and 
allow the engine to follow a fast transient. These modifications do result in increased performance; 
however this study indicates that these modifications also lead to an increased risk of engine failure. 

Nomenclature 

50 hr 50 Hour Engine (new) 

Accel Acceleration Limit (RPM/s) 

C-MAPSS Commercial Modular Aero-Propulsion System Simulation 

C-MAPSS40k Commercial Modular Aero-Propulsion System Simulation 40k 


EGT 

Exhaust Gas Temperature (°R) 

EOL 

End-of-Life Engine 

EPR 

Engine Pressure Ratio 

MAS 

Modified Acceleration Schedule 

Mid 

Mid Life Engine 

Nc 

Core Speed 

Nf 

Fan Speed 

PI 

Proportional Integral 

Ps3 max 

Maximum Combustor Static Pressure 

Std 

Standard Day Temperature (59 °F) 
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1.0 Introduction 


There is interest in the ability to use an aircraft’s engines to stabilize and control a distressed aircraft. 

It has been previously shown that in some emergencies the engines can serve as flight control actuators to 
improve the capabilities of the aircraft (Refs. 1 and 2). The ability of the aircraft’s engines to produce 
thrust beyond their current limitations and to respond more quickly to the pilot’s throttle command may 
result in an even greater likelihood of the recovery of a distressed aircraft. However, achieving elevated 
engine performance is complex due to limits that protect the mechanical system from severe structural 
damage such as rotor disk burst, and operability limits that ensure safe aero-thermal engine operation such 
as avoiding compressor surge. A risk performance study is conducted using the Commercial Modular 
Aero-Propulsion System Simulation 40k (C-MAPS S40k) to determine the tradeoff associated with 
extending or removing the engine controller’s limits and allowing the engine to operate beyond its 
nominal design range. This performance/risk study addresses two types of engine performance 
enhancements: 1) overthrust, where limits are relaxed/removed to allow the engine to produce additional 
thrust, and 2) faster engine response, where the limits and the controller bandwidth are modified to 
improve the responsiveness of the engine to the pilot’s throttle command. The two engine performance 
enhancements are in response to different aircraft emergency scenarios; these are not the only possible 
scenarios but are used as examples for these studies. The overthrust enhancement is in response to a 
runway incursion during takeoff, where the available distance for lift-off is suddenly decreased. Ideally, 
the additional thrust will accelerate the vehicle faster allowing the aircraft to takeoff with less available 
runway. The faster engine response enhancement tries to compensate for a rudder/tail failure, where the 
effectiveness of the rudder control surface or vertical stabilizer is reduced. This performance enhancement 
has been shown to enable the engines to behave dynamically as the control surface. More information 
about these scenarios can be found in Reference 3. 

Engine performance is purposely restricted through conservative controller design practices which are 
necessary to provide safe operation and consistent performance throughout the flight envelope and to 
conserve the life of engine components. However, in emergency situations the need to preserve safety 
margins can be traded for increased engine performance, which improves the survivability of the aircraft. 
This type of tradeoff is only considered for high risk situations; situations in which the aircraft is not 
capable of being flown safely. The ultimate goal of this work is to be able to subject the distressed aircraft 
to the minimum risk through the use of the enhanced propulsion control system; this is beyond the scope 
of this paper and more information about this topic is available in Reference 4. This analysis is limited to 
gaining an understanding of how engine risk is affected by changes to the engine controller limits. 

Previous work investigated the ability to obtain additional performance from a commercial aircraft 
engine. Reference 3 described a sensitivity study using the Commercial Modular Aero-Propulsion System 
Simulation (C-MAPSS), a model of a 90,000 lb thrust class engine. Reference 5 contains detailed results 
for a sensitivity study using C-MAPSS40k, a 40,000 lb thrust class engine. For the overthrust scenario, 
References 3 and 5 both conclude that to obtain additional thrust other engine variables will have to 
increase, possibly beyond their limits. However, neither reference identifies a generic tradeoff between 
enhanced engine performance and increased risk of operation. Reference 5 does show a trend based on a 
few flight conditions, but does not capture the entire performance/risk tradeoff that exists with the 
simulation model/risk calculations. Both References 3 and 5 discuss modifications to achieve increased 
engine responsiveness and they identify a subsequent reduction in either closed-loop stability margins or 
high pressure compressor surge margin; however these results are specific to flight conditions and are not 
generic. This performance/risk study attempts to determine the impact on the engine, in terms of risk of 
an engine failure incurred when providing additional performance, either overthrust production or 
increased engine responsiveness. 

This study is performed with the C-MAPSS40k engine. Details of this simulation and an overview of 
the engine controller is provided in Section 2.0. The results of the overthrust scenario are contained in 
Section 3.0, while the faster engine response results are in Section 4.0. Section 5.0 contains general 
conclusions. 
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2.0 Engine Control Overview 

This performance/risk study is conducted using the C-MAPSS40k engine simulation. C-MAPSS40k is 
a 40,000 lb thrust class, two spool, physics-based, component level, high bypass turbofan engine 
simulation with an associated closed loop controller. This engine simulation is modeled in the 
MATLAB/Simulink (The MathWorks, Inc.) environment (Ref. 6). 

The C-MAPS S40k engine control system regulates Engine Pressure Ratio (EPR), which is the low 
pressure turbine exit pressure divided by the engine inlet pressure. EPR is directly related to the thrust 
produced by the engine. The aircraft engine control system converts the pilot’s throttle command from a 
desired thrust level (idle, flight idle, take-off power, etc.) to an EPR setpoint, which is also affected by the 
current flight condition (altitude, Mach, and temperature). A setpoint controller responds to the EPR error, 
which is the difference between the setpoint and sensed EPR feedback, and drives the engine to the 
requested power level. In C-MAPSS40k, the setpoint controller features a Proportional Integral controller 
with integral wind-up protection. The setpoint controller determines the dynamic response of the engine 
to a throttle transient. 

Controller protection logic ensures that the setpoint controller will not cause the engine to violate any 
of its limits. This logic compares select engine sensed measurements against defined operating limits and, 
if necessary, adjusts fuel flow rate to rectify any limit exceedances. The C-MAPSS40k limiters include: 
maximum fan speed, maximum core speed, maximum combustor static pressure, maximum core shaft 
acceleration (based on an acceleration schedule), minimum combustor static pressure, and minimum ratio 
unit (fuel flow rate divided by the static combustor pressure). More information regarding aircraft engine 
control and the scheme employed in C-MAPSS40k can be found in Reference 7. In order for the results of 
this study to have the widest applicability, the study will maintain the existing control system architecture 
and only modify the control limit values. The general method employed in the study is to remove various 
limiters and observe the resulting change in engine performance. 

3.0 Overthrust 

In the overthrust scenario, Reference 3 found that the engine outputs such as rotor speeds, turbine 
temperatures, and compressor pressures, varied nearly linearly with the throttle input, and that the engine 
limits may need to be increased in order for the C-MAPS S engine to meet the overthrust demand. 
Reference 5 found that increasing the thrust demand resulted in a shift in the C-MAPSS40k engine 
outputs, although the shift is not necessarily linear. Reference 5 also found that increasing the engine’s 
thrust output resulted in increasing the risk of an engine failure, which is also dependent on the amount of 
time spent operating at the overthrust condition. An outcome of the Reference 5 study was the addition of 
a turbine temperature limiter designed to allow the temperature limit to be decreased based on the 
expected time of operation. 

In the overthrust scenario, the pilot requests additional thrust from the aircraft’s engines. To facilitate 
this, the EPR setpoints are extended to higher levels. For this study, the EPR setpoints are extended to 
correlate to 120 percent of the maximum rated thrust. In addition, the maximum fan speed, maximum 
core speed, and maximum combustor pressure limits are extended to 150 percent of their nominal values 
to allow the engine to reach the elevated EPR setpoint. A preliminary risk function has been implemented, 
which is similar to the one proposed in Reference 8, to evaluate the change in risk with operating at the 
higher power levels. This risk function, which is a probabilistic model of engine life as a function of 
operating condition, determines the probability of any mechanical engine failure. The engine is designed 
to have a certain life at a given probability of failure based on expected usage, and increasing the 
operating speed and temperature increases the risk of failure. The risk function is based on relationships 
between speed, temperature, and life consumption, and evaluates risk based on the anticipated overthrust- 
related operating conditions. As the engine runs, life is consumed increasing the risk of failure, and use of 
an overthrust control mode, because of the increased speeds and temperatures, consumes life significantly 
faster than normal. This reduction in engine life, combined with the current estimate of the engine 
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condition, determines the overall risk of engine failure. The overthrust scenario in this paper concentrates 
on takeoff, therefore the operating time used in the risk calculations is 1 5 min. 

The risk of engine failure is dependent on the flight condition (altitude, Mach number, and ambient 
temperature) as well as engine deterioration level. Therefore, in this performance/risk study the altitude, 
Mach number, ambient temperature, and engine deterioration level will be varied to determine the engine 
risk factor trends for different power levels. Figure 1 contains risk factor plots for two different airport 
elevations. This includes one airport at 5,431 ft above sea level (elevation at Denver International Airport) 
and a second airport at 2,181 ft above sea level (elevation at McCarran International Airport in Las 
Vegas, NV). Each of these plots show the risk factor for different power level commands (Full Power 
Throttle, %) for a new 50 hr engine, a mid-life engine (Mid), and an end-of-life engine (EOL) on both 
standard days (Std) and hot days (59 and 109 °F at sea level, respectively). 

Based on the data shown in Figure 1, generic observations regarding risk/performance tradeoff based 
on flight condition and engine life can be made. First, the elevation at which the power request is made 
plays a major role. This is shown by comparing the risk factor at 120 percent Max Power between the two 
different elevations. At the higher elevation airport (Denver), the risk factor is more than 10 times the risk 
factor at the lower elevation airport (McCarran). This is due to decreased air density at higher elevations, 
which decreases thrust production. Therefore, for the engine to produce the required thrust for takeoff, the 
engine has to operate at higher speeds and hotter temperatures. Another major contributor to the risk of 
engine failure is the ambient temperature. In both plots shown in Figure 1, the shape of the risk curve 
changes based on ambient temperature (comparing the blue lines to the red lines), and the risk at 
120 percent Max Power increases by a factor of 10 or more from a standard to a hot day. This effect is 
again due to decreased air density on hotter days. As the ambient temperature increases, the air density 
decreases. This again requires the engine to operate at higher speeds and temperatures to produce the 
thrust required for takeoff. Increased engine deterioration levels will cause an increase in the risk factor, 
but the increase is rather small compared to the effects of ambient temperature and elevation. As the 
engine degrades, the risk factor increases due to the components reaching their end of life; operating at 
the same altitude, ambient temperature, and EPR results in an increased risk of failure due to the fact that 
much of the component life has already been consumed. Furthermore, a degraded engine runs hotter, 
which also contributes to increased risk. 


Denver International Airport (5,431 ft) 


McCarran International Airport (2,181 ft) 
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Figure 1 . — Comparison of risk factor for varying power level, engine life, and temperature, at two different elevations 
(5,431 and 2,181 ft), both at Mach 0.15. 
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Figure 2. — Risk factor for varying takeoff conditions (altitude (ft), Mach number, ambient temperature, and 
engine age) for two power levels (115 percent max power and 120 percent max power). Note that the 
pilots’ predominant control is engine power level, all other parameters (altitude, Mach number, ambient 
temperature, and engine life) are essentially fixed; determined by the takeoff location (airport), the 
current local weather (temperature), and engine age. 


This type of evaluation can be extended to include many different takeoff conditions, by varying 
Mach number, altitude, ambient temperature, and power levels. Figure 2 compares the risk factor (as a 
contour plot) for varying altitude, Mach number, temperature, and engine deterioration level. The two 
plots shown in Figure 2 correspond to different power levels, 115 percent Max Power (left) and 
120 percent Max Power (right). 

The data in Figure 2 again show the effect of the ambient temperature on risk of failure. Comparing 
the two columns for each power level, a large change in the risk factor exists based on the temperature. 
Comparing the power levels, the data show that increasing the power level from 115 percent max power 
to 120 percent max power greatly increases the risk on hotter days, but not as much on standard days. 
Another observation is that at altitudes greater than 5,000 ft, the risk factor is increased drastically more 
compared to the lower altitudes. This suggests that at airports with an elevation of less than 3,000 ft, 
increasing the thrust output of the engine for takeoff maybe very practical due to the relatively low 
increase in risk. Flowever, at higher altitude aiiports, such as at Denver (altitude 5,431 ft), additional 
thrust may not be justified based on the increased risk level. These plots also indicate, as did the plots 
shown in Figure 1 that the engine life plays a minor role in increasing the risk of failure compared to the 
ambient temperature and altitude. 
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4.0 Faster Engine Response 


Increasing the responsiveness of the engine can be divided into two separate categories, one for small 
throttle transients and the other for large throttle transients. For the small throttle transients, Reference 3 
found that both increasing the controller bandwidth and disabling the controller limits allowed for a 
significant reduction in the settling time. Reference 5 however found that increasing the bandwidth alone 
was enough to increase the engine responsiveness since none of the limits become active for small throttle 
transients in C-MAPSS40k. The difference between these two findings can be attributed to a structural 
difference between the C-MAPSS controller, which was used in the previous studies, and the 
C-MAPSS40k controller protection logic. The C-MAPSS controller has an upper and lower bound on the 
change in fuel flow, limiting the acceleration based on change in fuel flow, whereas C-MAPSS40k limits 
the acceleration based on the current core speed of the engine and the magnitude of the change. 

Regarding large throttle transients, Reference 3 found that relaxing the turbine temperature limit, 
modifying the acceleration schedule, and increasing the controller bandwidth increased the engine 
responsiveness. Reference 5 proposed a Modified Acceleration Schedule (MAS), which is a look up table 
based method where an offset is added to the nominal acceleration schedule. This offset will increase the 
acceleration schedule resulting in a faster responding engine. 

The purpose of the faster engine response operation is to decrease the lag between the pilot’s 
command and engine response. In an emergency situation, such as a rudder/tail failure as the aircraft is 
approaching the runway, the pilot may find it necessary to execute a go around (abort the landing) and 
re-attempt the approach. For this type of maneuver, the pilot will move the throttle from flight idle (very 
low power level used during the approach) to takeoff thrust very quickly. In this type of situation, the 
acceleration schedule commands a conservative engine response to prevent high pressure compressor 
surge. The acceleration schedule in C-MAPSS40k is designed to ensure that the high pressure compressor 
surge margin is greater than 0.0 for a full throttle transient regardless of the flight condition (as long as the 
flight condition is inside the flight envelope) or the engine deterioration level. 

To increase the responsiveness of the engine for this type of command, the acceleration schedule may 
be modified to allow higher core acceleration, resulting in a faster engine response and decreased high 
pressure compressor surge margin. The modification of the acceleration schedule can be done from a 
lookup table that determines the acceleration schedule bias based on the flight condition and the engine 
deterioration level. This look up table method is referred to as Modified Acceleration Schedule (MAS) 
(Ref. 5). The nominal control response, referring to the engine response with no changes made to the 
controller, and MAS control responses to a full throttle transient with a 50 hr engine and an end-of-life 
engine are shown in Figure 3. 


50 Hour Engine 


End of Life Engine 


x iq 4 Standard Day 


x iq 4 Hot Day 




x -jq 4 Standard Day 


x iq 4 Hot Day 




Time, s Time, s Time, s Time, s 


Figure 3. — Engine responses to a full throttle transient for varying ambient temperature and engine degradation. 
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Figure 3 indicates that an increase in the ambient temperature will increase the settling time for the 
nominal control by about 2 sec. Considering the nominal control response between a 50 hr engine and an 
end of life engine for the same ambient temperature, the thrust response is nearly independent of engine 
life. Flowever, a reduction in engine life will decrease the surge margin; in Figure 3 the surge margin is 
reduced by about 4 percent over the entire life of the engine. Since the MAS control method of increasing 
the responsiveness trades surge margin for responsiveness, flight conditions and engine degradation levels 
that have the most surge margin available will be capable of larger thrust response improvements. This is 
very apparent in Figure 3; the condition with the largest surge margin reduction has the greatest 
performance increase. In this example, the MAS was designed such that the resulting surge margin never 
fell below 2 to 3 percent. The MAS was successful in 3 of the 4 scenarios, the surge margin for a 50 hr 
engine on a hot day decreased to below 2 percent, but stayed above 0 percent. This is due to nonlinearities 
in the engine and inaccuracies in the lookup table method. 

One of the uncertainties that the acceleration schedule must account for is normal engine-to-engine 
variation. Since a less than average engine must be able to accelerate safely, the acceleration schedule 
must be designed to accommodate a 3 sigma variation in surge margin to essentially guarantee that no 
engine will surge. If the engine-to-engine variation in surge margin is normally distributed with a standard 
deviation of 1 percent, then in the worst case 99.86 percent of all engines will accelerate safely for a 
3 percent designed minimum surge margin. Any adjustment of the acceleration schedule for faster engine 
response means that the below average engines are more likely to surge. The impact of the 3-sigma 
variation on faster engine response and surge margin in run-time can be seen in Figure 4. Figure 4 
compares the nominal control and MAS control surge margin response for the 50 hr engine on a standard 
day, the same response as shown in Figure 3, but with the 3 sigma variation around the surge margin. The 
lower bound on the surge margin in Figure 4 represents 99.86 percent of all 50 hr engines. By increasing 
the acceleration schedule to allow the surge margin responses shown in Figure 4, it is clear that there are 
50 hr engines in the fleet that would surge. When modifying the acceleration schedule, the risk is 
inversely related to the likelihood that the aircraft’s engines are better than an average 50 hr engine. The 
more likely that the engine is better than average, the greater the available surge margin and the less risky 
is the modification of the acceleration schedule. The second part of the risk is how much to increase the 
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Figure 4. — Surge Margin for 50 hr engine undergoing full throttle transient 
with nominal control and MAS control. 
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acceleration schedule, or how low to reduce the surge margin for an average engine. The more confidence 
there is that the engine is an average engine or better, the more the acceleration schedule can be increased, 
decreasing the engine surge margin closer to zero. However, if there is no confidence that the engine is an 
average engine or better, then the acceleration schedule modification may have to be more conservative. 

The C-MAPSS40k setpoint controller for EPR is a PI controller that dominates the response for 
smaller throttle transients that are unaffected by the acceleration limiter. The performance for these 
transients can be enhanced by increasing the bandwidth of the PI controller. The concern with increasing 
the bandwidth of the PI controller is decreasing stability margins (gain margin and phase margin) and 
actually decreasing the performance of the engine. A decrease in the stability margins can result in a 
decrease in performance, in terms of increased settling time, increased overshoot (below 2 percent is 
considered acceptable), and increased rise time. The only performance metric that may not be affected by 
the decrease in stability margins is the delay time, or the time it takes for the engine to respond to the 
throttle command. Figure 5 shows the settling time, percent overshoot, delay time, and rise time 
performance metrics as a function of the PI gain multiplier (bandwidth increase). The data were taken at 
altitudes from 0 to 28,000 ft in 4,000 ft increments, 0.0 to 0.7 Mach in 0.1 Mach increments, on both 
standard and hot days, and for a 50 hr engine, a mid life engine, and an end-of-life engine. 

The data in Figure 5 suggest that the PI controller gains can be increased, but only by a factor of about 
1.5. Increasing the gains by more than this may decrease the performance of the engine, which is shown 
in Figure 5 by the increase in settling time for multipliers greater than 1.5, an increase in the overshoot 
(above 2 percent) for multipliers greater than 2.5, and increased rise times for multipliers greater than 
approximately 1.5. The delay time improves for almost all of the tested data points, but does start to 
diverge after a multiplier of 3. This shows that it is possible to obtain additional performance from the 
engine by increasing controller gains; however there is a risk that the increased controller gains will 
actually decrease the performance of the engine, making the situation worse. 
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Figure 5. — Performance for small throttle transients for various PI gain multipliers. 
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5.0 Conclusions 


This paper discussed approaches to achieve enhanced engine performance and showed results from the 
application of these approaches to a turbofan engine simulation, C-MAPSS40k. For overthrust, the 
amount of additional thrust produced by the engine was compared to the risk factor, or the ratio of the risk 
of an engine failure caused by the use of additional thrust to the maximum normal operating risk. This 
study determined that altitude and ambient temperature are the two most significant factors in increasing 
the risk of an engine failure, especially as the amount of overthrust increases. At lower altitudes, even on 
a hot day, there was low to medium increase in risk to produce 120 percent maximum thrust. For the 
faster engine response, there were two different tradeoffs to compare depending on the size of the throttle 
transient. For large throttle transients, which are affected by the acceleration schedule, the acceleration 
schedule may be increased; this results in faster response and decreased settling time, but at the cost of 
decreasing the surge margin, which is directly related to the risk of an engine failure. The maximum 
benefit can be achieved with newer or above average engines, while similar performance improvement is 
much riskier with deteriorated engines. For smaller throttle transients, which are unaffected by the 
acceleration schedule, improved response speed is accomplished by increasing the controller bandwidth. 
Flowever this will actually decrease stability margins to the point where the performance is degraded. 
Based on the observations in this paper, the controller bandwidth can be increased up to 1.5 times the 
current level with little risk of performance degradation. These results show that it is possible, under the 
right conditions, to achieve significantly increased performance with little risk of engine failure, although 
improvement is severely limited without a significant risk increase in other cases. Understanding what the 
capabilities and limitations are can lead to new control algorithms to improve engine performance 
relatively safely. These conclusions are specific to the C-MAPS S40k type engine and controller, however 
the methodology in this paper can be used to evaluate the trade-offs for different engines and different 
controller architectures. 
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